keymanagerv1

type GenerateKeyRequest struct {

	// Required. The ID to give the generated key (or to identify the existing
	// key to overwrite (see GenerateKey).
	KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
	// Required. The type of the key to generate.
	KeyType KeyType `` /* 130-byte string literal not displayed */
	// contains filtered or unexported fields
}

type GenerateKeyResponse struct {

	// Required. The generated key.
	PublicKey *PublicKey `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	// contains filtered or unexported fields
}

type GetPublicKeyRequest struct {

	// Required. The ID of the key to retrieve.
	KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
	// contains filtered or unexported fields
}

type GetPublicKeyResponse struct {

	// Required. The public key to return.
	PublicKey *PublicKey `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	// contains filtered or unexported fields
}

type GetPublicKeysRequest struct {
	// contains filtered or unexported fields
}

type GetPublicKeysResponse struct {

	// Required. The public keys managed by the KeyManager. May be empty.
	PublicKeys []*PublicKey `protobuf:"bytes,1,rep,name=public_keys,json=publicKeys,proto3" json:"public_keys,omitempty"`
	// contains filtered or unexported fields
}

type HashAlgorithm int32

type KeyManagerClient interface {
	// Generates a new private key with the given ID. If a key already exists
	// under that ID, it is overwritten and given a different fingerprint. See
	// the PublicKey message for more details on the role of the fingerprint.
	GenerateKey(ctx context.Context, in *GenerateKeyRequest, opts ...grpc.CallOption) (*GenerateKeyResponse, error)
	// Gets the public key information for the private key managed by the
	// plugin with the given ID. If a key with the given ID does not exist,
	// NOT_FOUND is returned.
	GetPublicKey(ctx context.Context, in *GetPublicKeyRequest, opts ...grpc.CallOption) (*GetPublicKeyResponse, error)
	// Gets all public key information for the private keys managed by the
	// plugin.
	GetPublicKeys(ctx context.Context, in *GetPublicKeysRequest, opts ...grpc.CallOption) (*GetPublicKeysResponse, error)
	// Signs data with the private key identified by the given ID. If a key
	// with the given ID does not exist, NOT_FOUND is returned. The response
	// contains the signed data and the fingerprint of the key used to sign the
	// data. See the PublicKey message for more details on the role of the
	// fingerprint.
	SignData(ctx context.Context, in *SignDataRequest, opts ...grpc.CallOption) (*SignDataResponse, error)
}

type KeyManagerPluginClient struct {
	KeyManagerClient
}

type KeyManagerServer interface {
	// Generates a new private key with the given ID. If a key already exists
	// under that ID, it is overwritten and given a different fingerprint. See
	// the PublicKey message for more details on the role of the fingerprint.
	GenerateKey(context.Context, *GenerateKeyRequest) (*GenerateKeyResponse, error)
	// Gets the public key information for the private key managed by the
	// plugin with the given ID. If a key with the given ID does not exist,
	// NOT_FOUND is returned.
	GetPublicKey(context.Context, *GetPublicKeyRequest) (*GetPublicKeyResponse, error)
	// Gets all public key information for the private keys managed by the
	// plugin.
	GetPublicKeys(context.Context, *GetPublicKeysRequest) (*GetPublicKeysResponse, error)
	// Signs data with the private key identified by the given ID. If a key
	// with the given ID does not exist, NOT_FOUND is returned. The response
	// contains the signed data and the fingerprint of the key used to sign the
	// data. See the PublicKey message for more details on the role of the
	// fingerprint.
	SignData(context.Context, *SignDataRequest) (*SignDataResponse, error)
	// contains filtered or unexported methods
}

type KeyType int32

type PublicKey struct {

	// Required. The ID of the key, as provided when the key was created.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Required. The type of the key.
	Type KeyType `protobuf:"varint,2,opt,name=type,proto3,enum=spire.plugin.server.keymanager.v1.KeyType" json:"type,omitempty"`
	// Required. The public key data (PKIX encoded).
	PkixData []byte `protobuf:"bytes,3,opt,name=pkix_data,json=pkixData,proto3" json:"pkix_data,omitempty"`
	// Required. Fingerprint of the public key. The (id,fingerprint) tuple
	// uniquely identifies an "instance" of the key. When a key is overwritten
	// the fingerprint changes, indicating a different "instance" of that key
	// under the given ID.
	//
	// Proper key rotation requires that SPIRE not overwrite a key while it is
	// actively being used to sign data so that if the rotation operation
	// fails, SPIRE still has a valid key to use. SPIRE compares the
	// fingerprint returned from signing operations with the fingerprint it
	// expected for the key as a way to detect when it has mismanaged keys.
	// This is a mitigating measure and not expected to fail under normal
	// circumstances.
	//
	// There is no requirement that plugins persist the fingerprint. It can be
	// newly generated as long as it remains consistent for a given "instance"
	// of the key during runtime.
	//
	// The fingerprinting algorithm is also left to plugin implementations. A
	// native implementation is a non-cryptographic hash over the PKIX data.
	Fingerprint string `protobuf:"bytes,4,opt,name=fingerprint,proto3" json:"fingerprint,omitempty"`
	// contains filtered or unexported fields
}

type SignDataRequest struct {

	// Required. The ID of the key to use to sign the data.
	KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
	// Required. The data to sign.
	Data []byte `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
	// Required. The signature options. The PSS options are only valid
	// for RSA keys.
	//
	// Types that are assignable to SignerOpts:
	//	*SignDataRequest_HashAlgorithm
	//	*SignDataRequest_PssOptions
	SignerOpts isSignDataRequest_SignerOpts `protobuf_oneof:"signer_opts"`
	// contains filtered or unexported fields
}

type SignDataRequest_HashAlgorithm struct {
	HashAlgorithm HashAlgorithm `` /* 128-byte string literal not displayed */
}

type SignDataRequest_PSSOptions struct {

	// Required. The salt length.
	SaltLength int32 `protobuf:"varint,1,opt,name=salt_length,json=saltLength,proto3" json:"salt_length,omitempty"`
	// Required. The hash algorithm.
	HashAlgorithm HashAlgorithm `` /* 154-byte string literal not displayed */
	// contains filtered or unexported fields
}

type SignDataRequest_PssOptions struct {
	PssOptions *SignDataRequest_PSSOptions `protobuf:"bytes,4,opt,name=pss_options,json=pssOptions,proto3,oneof"`
}

type SignDataResponse struct {

	// Required. The signature of the data.
	Signature []byte `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
	// Required. The fingerprint of the key used to sign the data.
	KeyFingerprint string `protobuf:"bytes,2,opt,name=key_fingerprint,json=keyFingerprint,proto3" json:"key_fingerprint,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedKeyManagerServer struct {
}

type UnsafeKeyManagerServer interface {
	// contains filtered or unexported methods
}